package_patch action

To resolve #1416
allow anonymous access? is this just because the actual check is done by auth.update.package_update?